MalwarePublished 31 Oct 2025

Investigation Report: Android/BankBot-YNRK Mobile Banking Trojan

Source AlienVault OTX General

Description

Android/BankBot-YNRK is a sophisticated mobile banking Trojan targeting Android devices, specifically aiming at financial and cryptocurrency applications. It abuses Android accessibility services to gain elevated privileges, enabling it to automate UI interactions and extract sensitive user data. The malware can masquerade as legitimate apps, suppress audio notifications to avoid user detection, and perform unauthorized operations such as credential theft and fraudulent transactions. It maintains persistence on infected devices and communicates with command-and-control (C2) servers to receive remote commands and exfiltrate data. Although no known exploits are reported in the wild, the trojan represents a significant threat to Android users, especially those engaged in mobile banking and cryptocurrency activities. The malware’s complexity and stealth capabilities increase the risk of financial loss and privacy breaches. European organizations with employees or customers using Android banking or crypto apps are at risk, particularly in countries with high Android market share and digital banking adoption. Mitigation requires targeted measures including restricting accessibility service permissions, monitoring network traffic for suspicious domains, and educating users on app installation risks.

Impact

For European organizations, Android/BankBot-YNRK poses a substantial risk to employees and customers using Android devices for banking and cryptocurrency management. The trojan’s ability to steal credentials and perform unauthorized transactions can lead to direct financial losses and compromise of sensitive financial data. Organizations may face reputational damage, regulatory penalties under GDPR for data breaches, and operational disruptions if employee devices are compromised. The malware’s stealth features, such as suppressing notifications and masquerading as legitimate apps, increase the likelihood of prolonged undetected infections. Cryptocurrency wallets targeted by the trojan can result in irreversible asset theft, which is particularly concerning given the growing adoption of digital currencies in Europe. Additionally, the malware’s command-and-control communication can be leveraged for further attacks or lateral movement if devices are connected to corporate networks. The threat also complicates incident response due to its persistence and automation capabilities. Overall, the trojan threatens confidentiality, integrity, and availability of financial data and services accessed via Android devices within European enterprises and their customers.

Defensive guidance

1. Restrict and monitor accessibility service permissions on Android devices, allowing only trusted applications to use these services. 2. Implement mobile threat defense (MTD) solutions capable of detecting malicious behaviors such as UI automation and overlay attacks. 3. Educate users about the risks of installing apps from unofficial sources and the dangers of granting excessive permissions. 4. Monitor network traffic for connections to known malicious domains associated with BankBot-YNRK (e.g., ping.ynrkone.top, plp.e1in2.top) and block them at the network perimeter. 5. Employ application allowlisting to prevent installation of unauthorized or suspicious APKs. 6. Regularly update Android devices and banking/cryptocurrency apps to patch vulnerabilities and reduce attack surface. 7. Use multi-factor authentication (MFA) for banking and crypto applications to mitigate credential theft impact. 8. Conduct regular security awareness training focused on mobile threats and phishing. 9. Deploy endpoint detection and response (EDR) tools with mobile capabilities to identify anomalous behaviors indicative of malware. 10. Establish incident response procedures specific to mobile device compromises, including rapid containment and forensic analysis.

Summary

The Android/BankBot-YNRK malware family consists of multiple Android APK variants exhibiting advanced malicious capabilities. This banking Trojan abuses Android accessibility services to escalate privileges, allowing it to automate interactions with the device’s user interface and bypass security controls. It employs environment detection to evade analysis and implements persistence mechanisms to maintain long-term presence on infected devices. The malware masquerades as legitimate applications to deceive users and suppresses audio notifications to avoid raising suspicion during fraudulent activities. Its primary targets are financial applications and cryptocurrency wallets, from which it steals credentials and initiates unauthorized transactions. Communication with its command-and-control infrastructure is continuous, enabling remote control and data exfiltration. Indicators of compromise include several file hashes and suspicious domains such as ping.ynrkone.top and plp.*.top. Despite the absence of known exploits in the wild, the malware’s capabilities pose a medium severity threat due to its potential financial impact and stealth. The trojan’s reliance on accessibility services and UI automation makes it particularly dangerous as it can bypass many conventional security controls on Android devices. The threat is relevant to any user or organization relying on Android mobile banking or cryptocurrency applications, with a heightened risk in regions with significant Android usage and digital financial services penetration.

Indicators of compromise

Domains 4

ping.ynrkone.top
plp.e1in2.top
plp.en1inei2.top
plp.foundzd.vip

Hashes 5

dc7a2f60b55a7ce780be30ef815ef85d
3d1e9780c206bccd77aef429c0ace00b559466fa
19456fbe07ae3d5dc4a493bac27921b02fc75eaa02009a27ab1c6f52d0627423
a4126a8863d4ff43f4178119336fa25c0c092d56c46c633dc73e7fc00b4d0a07
cb25b1664a856f0c3e71a318f3e35eef8b331e047acaf8c53320439c3c23ef7c

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 31 Oct 2025, 10:39 UTC

Technical details

Indicators of compromise

Domains 4

Hashes 5

Community reviews

Related threats